diff --git a/vyos/gw01/config.boot.tmpl b/vyos/gw01/config.boot.tmpl
index 3e4e898..a00f639 100644
--- a/vyos/gw01/config.boot.tmpl
+++ b/vyos/gw01/config.boot.tmpl
@@ -696,6 +696,18 @@ nat {
                 address masquerade
             }
         }
+        rule 110 {
+            description "Masquerade Tailscale clients into the sandbox VLAN so tailnet-member hosts reply symmetrically"
+            outbound-interface {
+                name br40
+            }
+            source {
+                address 100.64.0.0/10
+            }
+            translation {
+                address masquerade
+            }
+        }
     }
 }
 protocols {